Website hacked? What to do, step by step (2026)

Signs your website was hacked

You usually find out one of four ways: Google or Chrome shows a red warning, your host emails you or suspends the account, visitors get sent to spam or scam pages, or you see pages, links or admin users you didn’t add. Sometimes the site looks normal to you but not to Google, which is why Search Console’s Security Issues report is worth checking.

Don’t panic, and don’t start deleting files. The first steps below cost nothing, and the order matters.

What to do, step by step

This order follows WordPress.org’s FAQ: My site was hacked and Google’s help for hacked sites. Most steps apply to any site; the cleanup steps are for WordPress and other self-hosted sites.

1. Write down what you see. Note what’s wrong, when you noticed it (with your time zone) and anything that changed recently, such as a new plugin or theme edit. The WordPress FAQ calls this “Document.”
2. Call or message your host. Ask whether they’ve found malware, suspended anything or already started a cleanup. Many hosts scan for malware, and some include removal on the plan.
3. Make the backup. Use your host’s backup tool or your backup plugin, or download files and the database through your hosting panel (our cPanel guide shows where those screens are). Keep this copy separate from your clean backups and label it “infected.”
4. Scan the site and your own computer. The WordPress FAQ suggests plugin scanners such as Wordfence and Sucuri, plus remote scanners such as Sucuri SiteCheck. SiteCheck is free, but Sucuri notes that “Remote scanners have limited access and results are not guaranteed,” because it only sees what a browser sees. Also run an antivirus scan on your computer, since the FAQ notes attackers may have stolen your logins from it.
5. Lock every door. Change the passwords for WordPress admins, your hosting account, SFTP or FTP, and the database. Turn on two-factor login. The FAQ also says to replace the secret keys in wp-config.php, which logs everyone out. Remove any admin user you don’t recognize, after the backup in step 3. When WordPress asks what to do with that user’s content, assign it to your own account instead of deleting it.
6. Clean the site. You have three options, covered in the next section: restore a clean backup, clean it yourself, or hire a cleanup service.
7. Update everything. Once it’s clean, update WordPress, every plugin and every theme, then change the passwords again, as the FAQ says.
8. Find how they got in. The FAQ calls this step “Forensics.” Check your host’s logs and look for an outdated plugin, a reused password or an old admin account. If you skip this, the same hole stays open.
9. Get off Google’s warning list. Request a review in Search Console, covered below.

Three ways to clean a hacked WordPress site

Restore a clean backup

This is often the fastest fix if you have a dated backup from before the hack. The catch is timing: a hack can start before you notice it, so pick a backup from well before the first sign, and expect to lose changes made since. Keep the infected backup from step 3 first, because a restore overwrites the current site. After restoring, do steps 5, 7 and 8 anyway, or the attacker can walk back in.

Clean it yourself

The WordPress FAQ’s method: reinstall the wp-admin and wp-includes folders by hand with the same WordPress version (not through the dashboard reinstall button), then check wp-content and files such as .htaccess, index.php, header.php, footer.php and functions.php for code you didn’t add. Reinstall plugins and themes from fresh copies. This takes care and some comfort with files. Back up first, and work on a copy if your host offers a staging site.

Hire a cleanup service

If the site makes money or you don’t want to touch server files, pay someone. Published prices:

Sources: Hostinger’s malware scanner article, Sucuri’s signup page and Wordfence’s plans page. Hostinger’s automatic scanner doesn’t check the database, but the paid cleanup includes MySQL injection cleanup, per that article.

Check your own host first. Bluehost lists malware detection and removal on its shared plans, SiteGround’s hosting page mentions “daily malware scans with free removal,” and it also sells a Site Scanner add-on whose Premium tier adds one-click automated cleanup (the price shows only in SiteGround’s Client Area). Jetpack Security also includes one-click fixes for threats its scanner finds.

What a cleanup plan costs over 3 years

The yearly plans are insurance, not one-off fixes. Over 3 years, at today’s prices for one site:

• Sucuri Basic Platform: $229 x 3 = $687.
• Wordfence Care: $590 x 3 = $1,770.
• Wordfence Response: $1,250 x 3 = $3,750.

Sucuri says multi-year signups get up to 30% off. A single $95 cleanup is cheaper if you have good backups and strong habits. A yearly plan makes more sense for a store or a site where a day offline costs more than the plan.

How to get off Google’s warning list

Google Safe Browsing powers those red warnings. Google says it helps protect “over five billion devices” every day, and that “Chrome and other browsers use Safe Browsing to show users a warning message,” per the Safe Browsing site. You can check any address with its Site Status tool.

What the warning types mean

Search Console’s Security Issues report sorts problems into groups, per Google’s help page. Knowing which one you have tells you where to look:

• Hacked content: pages, links or code added without your permission. Google lists malware, code injection, content injection (spam pages or text) and URL injection (new pages you didn’t create).
• Malware and unwanted software: files meant to harm visitors’ devices. Google’s malware page says the suspected files are listed in the report.
• Social engineering: content that tricks visitors into risky actions, such as fake login pages (phishing), deceptive pages or deceptive embedded resources such as ads.

A third-party ad or widget can trigger a warning even if your own files are clean, so check embedded scripts too.

To clear a warning on your own site, use the Security Issues report in Google Search Console. If you don’t have Search Console yet, set it up now with our Search Console guide; you’ll need to verify that you own the site, often through a DNS record.

1. Read the report. It lists the issue type (hacked content, malware, social engineering such as phishing, and others) with sample URLs, per Google’s Security Issues help page.
2. Check the sample pages safely. Google suggests the URL Inspection tool or cURL rather than opening infected pages in your browser.
3. Fix every issue across the whole site, not just the sample pages, and test.
4. Click Request review. Explain the problem, what you did and the result.
5. Wait. Google says “A review can take from a few days to a few weeks to complete.” Don’t resubmit before you get a decision. Google adds that asking for a review before everything is fixed can mean a longer wait next time and can get the site marked a repeat offender.

Builders vs WordPress when you’re hacked

On hosted builders, the platform runs the servers and software, so there are no plugins or server files for you to update or clean. Wix’s security overview describes a 24/7/365 security monitoring program, and Squarespace’s security page describes a Security Operations Center that watches around the clock.

That leaves your account. If someone gets in, reset your password, turn on two-factor login, review login activity (Squarespace shows active sessions), and contact the builder’s support. See our reviews of Wix and Squarespace.

With self-hosted WordPress, you get more control and more to look after. We build on WordPress every week, and on a self-hosted site, cleanup is your job or your host’s. That’s the fair trade: builders are right for owners who never want to think about this, and WordPress is right for owners willing to keep up with updates and backups.

If customer data may have been exposed

This part is general information, not legal advice. If the site stored customer details, such as form entries, accounts or orders, the hack may be a data breach. The FTC’s data breach response guide says to “Move quickly to secure your systems,” not to destroy evidence, and notes that “All states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation” requiring notice of breaches involving personal information. Health data can fall under separate federal rules. Talk to a lawyer about what applies to you.

What to do next

• Once you’re clean, work through our WordPress security guide so it doesn’t happen again.
• Set up dated, off-site website backups and test a restore.
• Clear any page cache after cleanup so visitors don’t get an old infected copy. Our WordPress speed guide explains how caching works.